Do we need a TODO here to check that the metrics requested are allowed for the given account?